52 Things: Number 11: What are the DLP, CDH and DDH problems?

This is the latest in a series of blog posts to address the list of '52 Things Every PhD Student Should Know To Do Cryptography': a set of questions compiled to give PhD candidates a sense of what they should know by the end of their first year. This blog is the second in the section on Mathematical Background and concerns how group operations can be used to design cryptographic primitives.
这是一系列博客文章中的最新一篇，旨在解决“每个博士生都应该知道的 52 件事来做密码学”列表：一组问题汇编，让博士生在第一年结束时了解他们应该知道什么。这篇博客是数学背景部分的第二篇，涉及如何使用组操作来设计加密基元。

As you probably know by now, cryptography often relies on 'hard problems'. That is, we design cryptographic protocols whose security can be proven if we assume that the adversary is unable to solve a certain (mathematical) problem in a reasonable amount of time. This blog post introduces three such problems which are widely used in security proofs. Luckily for me, a) this is really just Group Theory, not Computer Science and b) just two days before writing this I attended a very decent guest lecture by fellow Bristol Crypto researcher Susan Thomson on this exact topic. (That is to say, any inaccuracies in the following can and should be blamed on her!)
正如您现在可能知道的那样，密码学通常依赖于“难题”。也就是说，我们设计了加密协议，如果我们假设对手无法在合理的时间内解决某个（数学）问题，则可以证明其安全性。这篇博文介绍了三个在安全证明中广泛使用的问题。幸运的是，a）这真的只是群论，而不是计算机科学，b）就在写这篇文章的前两天，我参加了布里斯托尔加密研究员Susan Thomson关于这个确切主题的非常体面的客座讲座。（也就是说，以下任何不准确之处都可以而且应该归咎于她！

The Discrete Logarithm Problem (DLP)
离散对数问题（DLP）

Okay, let G be an abelian group. First we write the operation in G multiplicatively. For any g∈G and any integer a>1 let ga denote g&lowast;g&lowast;...&lowast;g with a occurrences of g. The discrete logarithm problem (DLP) is:
好吧，让我们 G 成为一个阿贝尔小组。首先，我们 G 用乘法写入运算。对于任何 g∈G 和任意整数， a>1 请 ga 用 a 的 g 出现次数表示 g&lowast;g&lowast;...&lowast;g 。离散对数问题（DLP）为：

Given G, g and h=ga, find a.
给定 G 和 g h=ga ，找到 a 。

Here a is called the discrete logarithm of h with base g, hence the name of the problem.
这里 a 称为 h 的离散对数 g ，因此问题的名称。

Is the discrete logarithm problem hard? Sometimes, maybe. As a counter-example, let G be the integers under addition. So now it makes sense to write the group operation additively, not multiplicatively. So the same process of repeating the group operation with the same element g is now written g+g+...+g with, say, a summands and, since we're working in the integers, this sum, call it h, is just equal to the integer ag. Therefore a, the discrete logarithm of h to the base g, can be found by just dividing h by g. For example, if I say to you, "find the discrete logarithm to the base 3 of 18 in the integers under addition", you'd just write 3+3+...+3=18 with a summands on the left, simplify this to 3a=18 and find that a=6. I could change the group to integers modulo N for some integer N>1 (still under addition) but the problem wouldn't be much harder: one has to solve an equation like ag&equiv;h(modN) which is solved by performing the Extended Euclidean Algorithm to find g−1(modN) (if it exists), multiplying this by h and reducing modulo N to obtain a. All of this is can be done in polynomial time - no good for building secure cryptographic primitives.
离散对数问题难吗？有时，也许。作为反例，假设 G 是加法下的整数。因此，现在以加法而不是乘法方式编写组运算是有意义的。因此，现在用 summands 编写了使用相同元素 g 重复组运算的相同过程，并且由于我们在整数中工作，因此这个总和（称为 h ）刚好等于整数 ag 。 g+g+...+g a 因此 a ，底的 h 离散对数 g 可以通过 h 除以 g 得到。例如，如果我对你说，“在加法下的整数中找到以 3 的 18 为底的离散对数”，你只需在左边 3+3+...+3=18 写 a 求和，将其简化为 3a=18 并找到 a=6 .对于某些整数（仍在加法中），我可以将该组更改为整数模 N ，但问题不会更难：必须求解一个方程，例如 ag&equiv;h(modN) 通过执行扩展欧几里得算法求解 g−1(modN) （如果存在），将其乘以 h 并减少模 N 以获得 a 。 N>1 所有这些都可以在多项式时间内完成 - 对于构建安全的加密原语没有好处。

On the other hand, the DLP in a finite field of prime order viewed as a group under multiplication (after throwing out the zero element) or in elliptic curve groups (more on those next week) is believed to be hard. That is, we do not yet know of any polynomial time algorithms for finding discrete logarithms in these groups. As a concrete example, suppose I ask you, "find the discrete logarithm to the base 3 of 5 in the multiplicative group of the integers modulo 7". This means find an integer a such that 3a&equiv;5(mod7). Now that we are in the multiplicative group, not the additive one and so we really do have to 'take logarithms' somehow, not just multiply by the inverse of 3. In this case, since 7 is fairly small, we can find the answer by just trying all the possibilities one at a time until we find a solution:
另一方面，在有限的素数阶域中，DLP被视为乘法组（抛出零元素后）或椭圆曲线组（下周将详细介绍）中的DLP被认为是困难的。也就是说，我们还不知道任何多项式时间算法可以在这些组中寻找离散对数。举个具体的例子，假设我问你，“在整数模 7 的乘法群中找到以 3 的 5 为底的离散对数”。这意味着找到一个整数， a 3a&equiv;5(mod7) 使得 .现在我们处于乘法组，而不是加法组，因此我们确实必须以某种方式“取对数”，而不仅仅是乘以 3 的倒数。在这种情况下，由于 7 相当小，我们可以通过一次尝试所有可能性来找到答案，直到我们找到解决方案：

31=3&equiv;̸5(mod7)
32=9&equiv;2&equiv;̸5(mod7)
33=(32)×3&equiv;2×3=6&equiv;̸5(mod7)
34=(33)×3&equiv;6×3=18&equiv;4&equiv;̸5(mod7)
35=(34)×3&equiv;4×3=12&equiv;5(mod7)

so a=5. The way we 'bounce around' the integers modulo 7 by repeatedly multiplying by the base 3 (getting 3, 2, 6, 4 and then 5) should give you some intuition as to why DLP seems hard in this setting. If our prime was much larger than 7, say thousands of bits long in binary, even a computer would take a very long time to solve DLP this way (though there are better, sub-exponential time algorithms and it is not proven that no polynomial time algorithm exists for solving DLP in this kind of group).
所以 a=5 .我们通过反复乘以 3 为底（得到 3、2、6、4 和 5）来“反弹”整数模 7 的方式应该会让您直观地了解为什么 DLP 在这种情况下看起来很困难。如果我们的素数大于 7，比如说二进制的数千位长，即使是计算机也需要很长时间才能以这种方式求解 DLP（尽管有更好的次指数时间算法，并且没有证明不存在用于求解此类组中的 DLP 的多项式时间算法）。

The Computational Diffie-Hellman Problem (CDH)
计算 Diffie-Hellman 问题（CDH）
A problem related to DLP is named after Whit Diffie and Martin Hellman who devised a way of two parties agreeing on a secret key over a public channel without revealing it:
一个与 DLP 相关的问题以 Whit Diffie 和 Martin Hellman 的名字命名，他们设计了一种方法，让双方在不透露的情况下通过公共频道就密钥达成一致：

Alice and Bob publicly agree on a cyclic group G and generator g.
Alice 和 Bob 公开同意循环群 G 和生成器 g 。
Alice chooses a random secret integer a and Bob chooses a random secret integer b.
Alice 选择一个随机秘密整数 a ，Bob 选择一个随机秘密整数 b 。
Alice computes ga and publicly sends this to Bob. Bob computes gb and publicly sends this to Alice.
Alice 计算 ga 并公开将其发送给 Bob。Bob 计算 gb 并公开将其发送给 Alice。
Alice and Bob both compute gab=(ga)b=(gb)a by raising what they received from the other party to power of their own secret integer.
Alice 和 Bob 都 gab=(ga)b=(gb)a 通过将他们从对方那里得到的东西提高到他们自己的秘密整数的幂来计算。

Now gab is a secret key that can be used for symmetric encryption and decryption by Alice and Bob. But someone listening in to the exchange has in their possession G, g, ga and gb. So secrecy of the key gab depends on this problem, called the Computational Diffie-Hellman Problem (CDH):
现在 gab 是一个密钥，可用于 Alice 和 Bob 的对称加密和解密。但是有人在听交流时，他们拥有 G 、 g ga 和 gb 。因此，密钥 gab 的保密性取决于这个问题，称为计算 Diffie-Hellman 问题（CDH）：

Given G, g, ga and gb, find gab.
给定 G 、 g ga 和 gb ，找到 gab 。

CDH is clearly related to DLP, but which is harder? Well, if I can solve DLP then I can efficiently compute the secret integer a from ga and then find gab by raising gb to the power a in the same way Alice does, therefore solving CDH. So anyone who can solve DLP can also solve CDH, meaning DLP is at least as hard as CDH.
CDH 显然与 DLP 有关，但哪个更难？好吧，如果我能解决 DLP，那么我就可以有效地 a 计算秘密整数， ga 然后以与 Alice 相同的方式通过提高到 gb 幂 a 来找到 gab ，从而解决 CDH。所以任何能解决DLP的人也可以解决CDH，这意味着DLP至少和CDH一样难。

The Decisional Diffie-Hellman Problem (DDH)
决策 Diffie-Hellman 问题（DDH）
This is another 'discrete logarithm' style problem used to prove indistinguishability properties. Say Alice and Bob perform the Diffie-Hellman key agreement protocol as above so that G, g, ga and gb are all public and gab is the shared secret key. Intuitively, the Decisional Diffie-Hellman Problem (DDH) asks whether an adversary can distinguish Alice and Bob's secret key gab from a random group element of G. Formally:
这是另一个“离散对数”风格的问题，用于证明不可区分性。假设 Alice 和 Bob 执行如上所述的 Diffie-Hellman 密钥协议，因此 G 、 g ga 和 gb 都是公共的，并且是 gab 共享的密钥。直观地说，决策 Diffie-Hellman 问题（DDH）询问对手是否可以将 Alice 和 Bob 的密钥 gab 与随机 G 组元素区分开来。正式：

Given G, g, ga, gb and Tx such that T0 is a random element of G, T1=gab and x is chosen uniformly at random from {0,1}, find x.
给定 G 、 g 、 ga gb 等 Tx T0 是的 G 随机元素， T1=gab 并且 x 从 {0,1} 中随机均匀选择，找到 x 。

If an adversary can solve DDH (i.e. output the correct value of x with probability greater than 12), then G, g, ga and gb must leak some information about the secret key gab that distinguishes it from a random group element, even if it can't be computed directly. What should be clear is that if the adversary can solve the computational Diffie-Hellman problem, then they can actually compute gab and hence trivially distinguish this element from a random group element, thereby solving the decisional Diffie-Hellman problem. So anyone who can solve CDH can also solve DDH, meaning CDH is at least as hard as DDH.
如果攻击者可以求解 DDH（即输出概率大于的正确值 x ），那么 G ， g ga ，并且 gb 必须泄露一些关于将其与随机组元素区分开来的密钥 gab 的信息，即使它不能直接计算。 12 应该清楚的是，如果对手能够解决计算的 Diffie-Hellman 问题，那么他们实际上可以计算 gab 并因此轻松地将该元素与随机群元素区分开来，从而解决决策 Diffie-Hellman 问题。所以任何能解决 CDH 的人也可以解决 DDH，这意味着 CDH 至少和 DDH 一样难。

These are the three problems we wanted to talk about and we've given a sketch proof of their ordering in terms of hardness: DLP is the most hard, then CDH and then DDH. As we've seen, DLP is sometimes easy, making CDH and DDH easy. So the choice of group G and generator g is very important when doing cryptography!
这是我们想要讨论的三个问题，我们已经给出了它们在硬度方面的排序的草图证明：DLP 是最硬的，然后是 CDH，然后是 DDH。正如我们所看到的，DLP 有时很容易，使 CDH 和 DDH 变得容易。所以在做密码学的时候，组 G 和生成器 g 的选择是非常重要的！

3cH0_Nu1L

52 Things: Number 11: What are the DLP, CDH and DDH problems?

公告